[PATCH 0/3] io_uring: fix resource leak issues

[KobaK]

From: Koba Ko <kobak@xxxxxxxxxx>

Three resource leak fixes found by code audit:

1. memmap: pinned pages and pages array leak on WARN_ON path in
   io_region_pin_pages() — mr->pages is never assigned so the caller's
   cleanup is a no-op.

2. rsrc: kfree() used instead of io_cache_free() in
   io_buffer_register_bvec() error path — bypasses cache return.

3. zcrx: io_import_umem() leaves live pinned pages in a partially
   initialized struct on io_account_mem() failure, and
   io_release_area_mem() is not idempotent (missing pages = NULL),
   creating a double-free hazard.

Koba Ko (3):
  io_uring: fix pinned pages and pages array leak in
    io_region_pin_pages()
  io_uring/rsrc: use io_cache_free for node in io_buffer_register_bvec
    error path
  io_uring/zcrx: fix resource leak and double-free hazard in
    io_import_umem

 io_uring/memmap.c |  5 ++++-
 io_uring/rsrc.c   |  2 +-
 io_uring/zcrx.c   | 19 +++++++++++++------
 3 files changed, 18 insertions(+), 8 deletions(-)

-- 
2.43.0